In practice, other than the Windows Kernel, the only things running in kernel space tend to be drivers, a/v software and malicious code.